I agree, GP, and a lot of other people, please r!t!F!a! I can't believe how many idiots blame the browsers and w3c themselves for the idiocy of some "software developers".
Geez, reading the comments, I can see the internet is getting dumber every minute (thanks to e.g. Digg), and that effect is spreading into Slashdot as well.
Just like in motor racing (at least those without rolling starts, e.g. Formula One): the lights go green and all the cars accelerate as one... I agree it would be a lot more efficient, but then the grandpa in the car in front of you might not be an F1-driver. If he waits just a bit too long you'll run into him.. Maybe you can just leave more distance to the car in front when stopping. But then again if you notice the car in front of you isn't moving, you brake, and a moment later the car behind you notices you braked, and a moment later the car behind him crashes into him because the driver noticed him braking a tick too late...
Reminds me of the collision between a private jet an a Jumbo in Brazil, that downed the Jumbo. An author that writes for the NYTimes was in the private jet, he wrote a chilling article about it, where he mentioned that they didn't even see the Jumbo, and according to calculations, they passed each other at 500 mph.
Never mind, apparently the speakers don't get turned off after all when using newer versions of the program. Apparenty that behaviour is even hackable from the software side, which is neat.
The Windows Update nag window, ah who isn't familiar with it. Although, the one I know asks you if you want to restart now, or do you want the dialog box to nag you 15 mins from now?
Once I just moved it to the extreme side of my desktop so I could ignore it while not making a choice. And then I also used WinRoll to move it to the background from its default always-on-top setting.
I think you can also kill wupdate.exe or stop the whole auto-update service to make it stop nagging.
A similar experience: I start Word, it pops up a window saying "Now configuring Adobe Acrobat 7. Cannot find AcroPro.msi, please enter path to AcroPro.msi.". "Cancel!", But no, in their world cancel means "Nag me again!" as it rinsed and repeated.
"OK OK, here's the CD you idiot!". "Installing... all done, but I have to reboot. Reboot now?"
All because Acrobat wants to (re-)put 3 fucking icons into Word's toolbar that I don't even need.
One way I'd solve this is, you can start the player and movie, and hit pause at a certain point, e.g. when the movie logo shows up. Then you can tell your wife to load it and hit pause when the logo shows up. This makes sure loading latencies don't affect anything. After you're both paused at the same place, you can just do a countdown and unpause at zero.
But as the other poster said, the cellphone network might have other ideas of latencies...
True that. At least the 4 year old might be amusing for a bit, but it's not really funny, it's LAME. Slashdot, if you want to amuse me, do something subtle or elaborate that really fools me, not something that is obviously fake that I'd say "oh, cute, so what else you got?".
Ah, reminds me of Gunship 2000. If your helicopter ends up disabled in enemy territory, you can always enable the "maintain altitude at 100 ft" flying help, turn on your engines, and the chopper will hover to 100ft. Push the joystick forwards and you'll start falling to the ground again, but you'll land a few hundred meters in front of where you were before. Rinse and repeat, and make like a frog back to the base.
Isn't it great how Microsoft's suggested workarounds only say "View E-Mail in plain-text, don't visit untrusted sites" (even though they claim beforehand an attacker might also try to hijack trusted sites to deliver the exploit).
Guess they can't write the obvious, "Use an alternative browser and/or email client.". Hah, what a Dubya-ian world they're living in.
So I'm assuming the way to exploit it is with CSS's cursor property: cursor: url('some-bad-file.ani'); I'm guessing Firefox has its own animated cursor rendering engine? Are they even allowed in CSS...
Ah, the irony of something that is unnecessary other than making the GUI look pretty being responsible for endangering the system...
She was in front of a classroom full of children, malwared-IE started popping up porn ads, everybody goes nipple-gate because "she's exposing them to porn!!!".
I agree with you on the genre problem, not to mention that a lot of people miscategorize song genres... just because a hip-hop song is in a movie soundtrack, it gets "Soundtrack" as its genre. As far as I know "Soundtrack" technically means the audio track of a movie. When I got MediaMonkey to tag my MP3s (here's another, different definition of "tag", the ID3-tag) I just started removing genres from all of them. MediaMonkey has its own internal DB where you can classify songs according to their tempo, mood, occasion and audio quality (although this last one is more of a technical property), which is probably what you'd need. It's Windows only, unfortunately, but you can probably duplicate such a feature with Amarok labels and a labelling standard. I myself haven't bothered labelling all my music.
The author of the paper says things like "innovative new attack" and "next generation of server side injection."
That's why I feel he's just tooting his own horn. If you can exploit an XSS-hole, you can put anything you want into the webpage, even adding Javascript into a plain scriptless page. E.g. you can add an onclick event handler to every link (or form submit button), which calls a function that in turn fetches an image from a 3rd party server. You can then piggyback data onto that request, as the sniff() function on page 4 of the paper does. No Ajax required!
The problem isn't the use of Ajax (or XmlHttpRequest) itself is harmful, the problem is XSS-holes are harmful! The XSS holes can come from incompetent browser-programmers or from incompetent webapp-programmers (e.g. if someone made a clone of Slashdot and allowed <script>-tags in the comment box). Luckily there are only a few of the first kind, but unfortunately there are plenty of the latter.
By the way, "S. Di Paola" is half of the author-team who wrote this paper. So when he says
This technique has been found by S. Di Paola and is called Prototype Hijacking. It represents the state of the art in hijacking techniques applied to the Javascript language.
my bullshit-meter went off the charts. "Hijackability", i.e. the ability to modify an object is really a basic feature of Prototype-based languages and there's really nothing state of the art about it.
Basically, be online, surf the area you want, then go offline. Then the area will be cached (up to 2 GB, the article also mentions having multiple cache files around and swapping them around manually).
The cell phone ping came 2 days after he left them. If he had stayed with them there would have been no ping and the searchers even said they were looking in the totally wrong places. Even then it was luck that there was a pilot who knew the roads and had a hunch about the wrong turn (the turn-off was a larger road than the main road), so he took his own copter to take a look around the area, and boom, found them.
But only 3 of them and not James.. too bad, poor guy. RIP.
7 or so years ago I heard a great quote about this problem. "Technically, the nerds arguing that the new millennium doesn't start for another year are correct, but the rest of the world will party anyway."
Use Monopoly money... or something to that effect: just let the patrons buy the fake money (and provide lots of vending machines throughout the club) and let them spend it. Of course allow them to change it back to normal currency after their patronage. It has other benefits too: the clubs can print out whatever they want on their "money", and if they make it out of washable materials they can ensure their, uhm, employees' hygiene.
Wow, maybe I should do consulting for the live adult entertainment industry.
Should be easy enough to make, with IE and Firefox's openness - you can use VB/VBA with IE. And with Firefox, either you modify the source code (well that's no longer easy) or write a JavaScript extension..
Slashdot Mirror
I agree, GP, and a lot of other people, please r!t!F!a! I can't believe how many idiots blame the browsers and w3c themselves for the idiocy of some "software developers".
Geez, reading the comments, I can see the internet is getting dumber every minute (thanks to e.g. Digg), and that effect is spreading into Slashdot as well.
Remember http://www.youtube.com/watch?v=KyLqUf4cdwc
Just like in motor racing (at least those without rolling starts, e.g. Formula One): the lights go green and all the cars accelerate as one... I agree it would be a lot more efficient, but then the grandpa in the car in front of you might not be an F1-driver. If he waits just a bit too long you'll run into him.. Maybe you can just leave more distance to the car in front when stopping. But then again if you notice the car in front of you isn't moving, you brake, and a moment later the car behind you notices you braked, and a moment later the car behind him crashes into him because the driver noticed him braking a tick too late...
... and capital punishment for officials caught corrupting.
(I hope the above isn't construed as a death threat against Bush! And his staff. And Congress. And the Senate. DHS... TSA...)
The best one was from "Saving Private Brian".
Stewie: This is like the time [...].
Pause...
Stewie: What? No clip? Ah, okay...
Reminds me of the collision between a private jet an a Jumbo in Brazil, that downed the Jumbo. An author that writes for the NYTimes was in the private jet, he wrote a chilling article about it, where he mentioned that they didn't even see the Jumbo, and according to calculations, they passed each other at 500 mph.
Not really, I live in Germany and all I can think to say to this lawsuit-happy dickhead is, "thanks, douchebag!"
But I think the gmail.com addresses will still work, or I can just say I live in the US (oh the horrors!)
Never mind, apparently the speakers don't get turned off after all when using newer versions of the program. Apparenty that behaviour is even hackable from the software side, which is neat.
They also have headphone jacks, which, when you plug in headphones into it, turns off the built-in speakers.
The Windows Update nag window, ah who isn't familiar with it. Although, the one I know asks you if you want to restart now, or do you want the dialog box to nag you 15 mins from now?
Once I just moved it to the extreme side of my desktop so I could ignore it while not making a choice. And then I also used WinRoll to move it to the background from its default always-on-top setting.
I think you can also kill wupdate.exe or stop the whole auto-update service to make it stop nagging.
A similar experience: I start Word, it pops up a window saying "Now configuring Adobe Acrobat 7. Cannot find AcroPro.msi, please enter path to AcroPro.msi.". "Cancel!", But no, in their world cancel means "Nag me again!" as it rinsed and repeated.
"OK OK, here's the CD you idiot!". "Installing... all done, but I have to reboot. Reboot now?"
All because Acrobat wants to (re-)put 3 fucking icons into Word's toolbar that I don't even need.
eh..
print "Please take your card and your money";
IF (bReceiptRequested) {
print " AND your receipt";
}
I think it can figure this out if you were in a "table of contents" page before starting to view the images. Just a hunch.
One way I'd solve this is, you can start the player and movie, and hit pause at a certain point, e.g. when the movie logo shows up. Then you can tell your wife to load it and hit pause when the logo shows up. This makes sure loading latencies don't affect anything. After you're both paused at the same place, you can just do a countdown and unpause at zero.
But as the other poster said, the cellphone network might have other ideas of latencies...
True that. At least the 4 year old might be amusing for a bit, but it's not really funny, it's LAME. Slashdot, if you want to amuse me, do something subtle or elaborate that really fools me, not something that is obviously fake that I'd say "oh, cute, so what else you got?".
Ah, I guess expecting nerds to be hip is hard.
Ah, reminds me of Gunship 2000. If your helicopter ends up disabled in enemy territory, you can always enable the "maintain altitude at 100 ft" flying help, turn on your engines, and the chopper will hover to 100ft. Push the joystick forwards and you'll start falling to the ground again, but you'll land a few hundred meters in front of where you were before. Rinse and repeat, and make like a frog back to the base.
Good ol' times...
Isn't it great how Microsoft's suggested workarounds only say "View E-Mail in plain-text, don't visit untrusted sites" (even though they claim beforehand an attacker might also try to hijack trusted sites to deliver the exploit).
Guess they can't write the obvious, "Use an alternative browser and/or email client.". Hah, what a Dubya-ian world they're living in.
So I'm assuming the way to exploit it is with CSS's cursor property:
cursor: url('some-bad-file.ani');
I'm guessing Firefox has its own animated cursor rendering engine? Are they even allowed in CSS...
Ah, the irony of something that is unnecessary other than making the GUI look pretty being responsible for endangering the system...
http://www.boingboing.net/2007/02/14/teacher_faces _jail_t.html
She was in front of a classroom full of children, malwared-IE started popping up porn ads, everybody goes nipple-gate because "she's exposing them to porn!!!".
Anyway, typing "format C:" in a running Windows doesn't work, because it will say "The volume is in use." (assuming Windows is on C:)...
;-)
Don't believe me? Try it yourself.
I agree with you on the genre problem, not to mention that a lot of people miscategorize song genres... just because a hip-hop song is in a movie soundtrack, it gets "Soundtrack" as its genre. As far as I know "Soundtrack" technically means the audio track of a movie. When I got MediaMonkey to tag my MP3s (here's another, different definition of "tag", the ID3-tag) I just started removing genres from all of them. MediaMonkey has its own internal DB where you can classify songs according to their tempo, mood, occasion and audio quality (although this last one is more of a technical property), which is probably what you'd need. It's Windows only, unfortunately, but you can probably duplicate such a feature with Amarok labels and a labelling standard. I myself haven't bothered labelling all my music.
That's why I feel he's just tooting his own horn. If you can exploit an XSS-hole, you can put anything you want into the webpage, even adding Javascript into a plain scriptless page. E.g. you can add an onclick event handler to every link (or form submit button), which calls a function that in turn fetches an image from a 3rd party server. You can then piggyback data onto that request, as the sniff() function on page 4 of the paper does. No Ajax required!
The problem isn't the use of Ajax (or XmlHttpRequest) itself is harmful, the problem is XSS-holes are harmful! The XSS holes can come from incompetent browser-programmers or from incompetent webapp-programmers (e.g. if someone made a clone of Slashdot and allowed <script>-tags in the comment box). Luckily there are only a few of the first kind, but unfortunately there are plenty of the latter.
By the way, "S. Di Paola" is half of the author-team who wrote this paper. So when he says
my bullshit-meter went off the charts. "Hijackability", i.e. the ability to modify an object is really a basic feature of Prototype-based languages and there's really nothing state of the art about it.
Offline Google Earth Use
Basically, be online, surf the area you want, then go offline. Then the area will be cached (up to 2 GB, the article also mentions having multiple cache files around and swapping them around manually).
The cell phone ping came 2 days after he left them. If he had stayed with them there would have been no ping and the searchers even said they were looking in the totally wrong places. Even then it was luck that there was a pilot who knew the roads and had a hunch about the wrong turn (the turn-off was a larger road than the main road), so he took his own copter to take a look around the area, and boom, found them.
But only 3 of them and not James.. too bad, poor guy. RIP.
7 or so years ago I heard a great quote about this problem. "Technically, the nerds arguing that the new millennium doesn't start for another year are correct, but the rest of the world will party anyway."
Use Monopoly money... or something to that effect: just let the patrons buy the fake money (and provide lots of vending machines throughout the club) and let them spend it. Of course allow them to change it back to normal currency after their patronage. It has other benefits too: the clubs can print out whatever they want on their "money", and if they make it out of washable materials they can ensure their, uhm, employees' hygiene.
Wow, maybe I should do consulting for the live adult entertainment industry.
Should be easy enough to make, with IE and Firefox's openness - you can use VB/VBA with IE. And with Firefox, either you modify the source code (well that's no longer easy) or write a JavaScript extension..